client certificate expiration seconds must greater or qual to 3600

[youhangwang]

In PR: open-cluster-management-io/registration#312, a option --client-cert-expiration-seconds was exposed so that a user can specify a expiration seconds for the client cert. And we use the minimum value of expiration time in CSR - 10min to check if the expiration time is validated.

However, for the clientCertificateController in registration, 600 is too short:

1. clientCertificateController to check if cert is expired every 5min.
2. kubeclient resync the client cert every 5min.
3. clientCertificateController will refresh the cert if the cert has less than a random percentage range from 20% to 25% of its life remaining.

so the minimum expiration second would be (5 * 60)/(1/5) = 1500s for clientCertificateController. otherwise, the kube client will use a expired client cert to send request to the remote cluster.

Considering to add some margin. 1h(3600s) could be a good choice.

[qiujian16]

hrm, seems there is some issue with operator e2e...I am looking at it.

[qiujian16]

@youhangwang would you rebase the PR, there was a bug in the code that is fixed in #150

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (main@6f21760). Click here to learn what that means.
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #149   +/-   ##
=======================================
  Coverage        ?   58.42%           
=======================================
  Files           ?      107           
  Lines           ?    11847           
  Branches        ?        0           
=======================================
  Hits            ?     6922           
  Misses          ?     4254           
  Partials        ?      671           

Flag	Coverage Δ
unit	58.42% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[youhangwang]

@qiujian16 branch was rebased on the main branch

[qiujian16]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiujian16, youhangwang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [qiujian16]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment